One is enough

Securinets-Quals-CTF-2023   PWN  

题目作者: 未知

一　　血: ‌‌‌‌‌admin889

一血奖励: 0金币

解　　决: 1

提　　示:

描　　述:

Notes:

• There is an off by one in readInput function. The call tree main -> readDescription -> readInput would result in overwriting a nullbyte in the least significant byte of the saved RBP in readDescription call-stack. The leave; ret instruction at the end of the readDescription would result in restoring the saved RBP after being modified. Chained with the leave; ret instruction at the end of the main function, this would result in a stack pivot.
• Send a large enough payload with a new line (which will be overwritten with a null byte). The payload should contain a ROP chain.
• This won't be always successful, the solve I provided calls readInput to write a stage 2 rop chain in bss then stack pivots.

附　　件: 下载

去做题